Technical Field
The present disclosure generally relates to electronic circuits and, more specifically, to data processing units implementing encryption or decryption algorithms. The present disclosure more specifically relates to mechanisms for protecting the content of registers against unidirectional disturbances of bits that it contains.
Discussion of the Related Art
When a processing unit (typically, a cryptoprocessor) is used to implement an encryption algorithm, it is desired to check that the manipulated key has not been modified (incidentally or willfully), either during its transfer to the cryptoprocessor from an external circuit, or once in this cryptoprocessor while it is contained in a specific register thereof. Attacks aiming at disturbing the state of a bit of a register of the cryptoprocessor generally are attacks using a laser pointed on one of the bits of the register containing the key to disturb its value.
To counter a modification during the transfer, a solution is to reload the key in the cryptoprocessor as often as possible, generally on each new encryption, or periodically. However, the key register of the cryptoprocessor remains sensitive to laser attacks.
To check the integrity of the key once it is in the cryptoprocessor, the simplest would be to read this key to control it outside of the cryptoprocessor. However, to protect the key against possible hacking attempts, the temporary storage element (register) which contains the key is generally only accessible in read mode from outside of the cryptoprocessor. The integrity check then amounts to checking the consistency of results obtained by two separate calculations using the key contained in the cryptoprocessor. These two calculations are either two encryptions of a same message with the key, or an encryption followed by a decryption.
It has already been provided to check the consistency between two executions of the same algorithm, respectively with the key and with the key complemented to one. Such a solution is described in document USA-2009/0285398.
A difficulty lies in the fact that the results of an integrity check mechanism may provide information to the attacker as to the value of the bits of the key. For example, it is assumed that a successful attack causes a switching of a bit to state 1. If the attacked bit is at state 0, it will switch values. If the attacked bit is at state 1, its value remains unchanged. In this latter case, the checking mechanism is unable to notice the attack. Now, the attacker knows that he has attacked the corresponding bit. According to whether an attack detection bit switches state or not, the attacker can thus know whether the attacked bit was in a state 0 or 1. In other words, if one of the bits of the key is modified and the old and new values of this bit are the same, the checking mechanism is unable to notice it, be the checking direct (by rereading) or indirect (by two distinct calculations). This makes the key vulnerable to an attack or disturbance known as a unidirectional disturbance, which comprises forcing a bit of the key to a single one of the possible values. For example, the attacked bit is forced to zero whatever its initial state (1 or 0). The forcing of a bit to a single one of the two states may enable an attacker to determine the value of this bit according to whether his attack is or not detected (if it is not detected, then the actual bit of the key has the forced value—if it is detected, the actual bit of the key has the other state). By repeating this attack on each bit of the key, the value of said key can be obtained.
Further, a unidirectional attack may be performed simultaneously on several bits of a register, for example by using several laser beams directed towards several cells of the register.
It should be noted that the laser beam attack targets registers used in the calculations. The countermeasures are thus relative to the registers used for these calculations which, according to the algorithm using this register, may contain only a portion of the message and/or of the key.
An additional issue is to provide a countermeasure or protection mechanism which is simple to implement and which requires no modification of the hardware structure of the cryptoprocessor.
US 2008/0056488 discloses a cryptographic module with two registers respectively retaining a first data related to key data and a second data without dependency on the first data.
WO 2005/124506 discloses a cryptographic architecture with masking instructions against DPA attacks and provides toggling the polarity of some bits while maintaining the equal probability of having a 0 or 1 values.